Security of Dereference in Linked Data

On Tue, 2010-07-06 at 23:27 +0200, Dan Brickley wrote:
> On Tue, Jul 6, 2010 at 11:17 PM, Pat Hayes <phayes@ihmc.us> wrote:
> [...]
> >> This is
> >> the canonical way to find it's meaning, and is the initial procedure we
> >> should use to arbitrate between competing understandings of its meaning.
> >
> > Whoo, I doubt if that idea is going to fly. I sincerely hope not. Using
> > that, how would you determine the meaning of the DC vocabulary?
> 
> It's also worth bearing in mind that Web sites get hacked from time to
> time. W3C gets attacked regularly (but is pretty robust). The FOAF
> servers were compromised a year or two back (but the xmlns.com site
> was untouched). For a while, foaf-project.org was serving evil PHP and
> ugly links, as was my own home page. This kind of mischief should be
> kept in mind by anyone building a system that assumes you'll get
> canonical meaning from an HTTP GET...

My first answer to this is that lots and lots of society trusts the Web
in general and certain websites in particular.  Before the world learns
to adopt and trust linked data, the vocabulary servers are probably
going to have to become more robust and carefully managed.

My second answer is to mention a proposal I worked on some years back to
tackle this with crypto:  http://www.w3.org/2003/08/introhash/v2

I backed off that proposal because I think, at least for now, the first
answer is good enough.   But I still like the general idea of putting
hashes into URIs to make them more secure and to  allow for secure
mirroring, ... but we'll have to see if it becomes worthwhile some day.

  -- Sandro

Received on Wednesday, 7 July 2010 04:11:41 UTC